Module finding 

Court-safe forensic finding model (RFC 0001 — D4 provenance, D5 the Priority/Confidence/Interpretation split, D9 multi-user origin).

A Finding keeps the three epistemic axes structurally separate so no renderer can collapse them into a bare HIGH that reads as high confidence of wrongdoing:

• Priority — a triage attention cue (look here first), never a verdict.
• Confidence + rule_id — how strongly the interpretation is supported.
• interpretation — the hedged “consistent with …” statement.

Because Priority and Confidence are distinct types, the compiler makes it impossible to pass one where the other belongs. There is deliberately no Display impl on Finding that could emit an absolute; render a finding with Finding::render, which always shows the three axes separately and always carries the interpretation hedge.

Structs

Finding

A court-safe forensic finding (RFC 0001 D4/D5/D9).

Provenance

The four provenance axes (RFC 0001 D4). They travel together so a Finding can never be constructed without a full provenance record — no silent, misleading default.

Enums

Confidence

How strongly the finding’s interpretation is supported (RFC 0001 D5). Always travels with a rule_id on the Finding.

EvidenceSource

Where the datum was read from — a coarse provenance axis (RFC 0001 D4). A live history hit, a carved string, and a cached resource have different courtroom value; this axis records which.

EvidenceState

Liveness / derivation state of the datum (RFC 0001 D4).

Priority

Triage attention cue — where to look first (RFC 0001 D5).

TimestampBasis

Basis for the timestamp attached to a finding (RFC 0001 D4/D8).

UserActionClaim

The user-action the evidence supports — stated as a claim, never a verdict (RFC 0001 D4). “Observed string” is the weakest: the term merely appeared in stored bytes, with no proof a human acted on it.